UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign

Google researchers attribute an ongoing, financially motivated extortion campaign to UNC3753 (aka Chatty Spider / Silent Ransom Group) that targets professional, legal, and financial services via vishing and social-engineering pretexts to induce victims to run legitimate RMM/remote‑access tools, enabling rapid file discovery and exfiltration. Stolen data (legal agreements, PII, financial records) is staged to fast‑flux domains and a public leak site, with extortion demands typically issued within hours; the actor shares overlaps with past Conti offshoot activity and has been observed using LockBit Black historically.